jackson-databind:ObjectReaderRandomClassFuzzer: Security exception in org.jboss.forge.roaster._shade.org.eclipse.jdt.internal.compiler.parser.Scanner.

Project: https://github.com/FasterXML/jackson-databind.git Detailed Report: https://oss-fuzz.com/testcase?key=6585860639817728 Project: jackson-databind Fuzzing Engine: libFuzzer Fuzz Target: ObjectReaderRandomClassFuzzer Job Type: libfuzzerasanjackson-databind Platform Id: linux Crash Type:...

jackson-databind:ObjectReader2Fuzzer: Security exception in com.code_intelligence.jazzer.sanitizers.RegexInjection.hookInternal

Project: https://github.com/FasterXML/jackson-databind.git Detailed Report: https://oss-fuzz.com/testcase?key=6575529599303680 Project: jackson-databind Fuzzing Engine: libFuzzer Fuzz Target: ObjectReader2Fuzzer Job Type: libfuzzerasanjackson-databind Platform Id: linux Crash Type: Security...

jackson-databind: denial of service via a large depth of nested objects

A flaw was found in the Jackson Databind package. This cause of the issue is due to a Java StackOverflow exception and a denial of service via a significant depth of nested objects...

The vulnerability of the DOMDeserializer component in the FasterXML jackson-databind library allows attackers to execute XXE attacks.

The vulnerability of the DOMDeserializer component in the FasterXML jackson-databind library is related to an incorrect limitation on XML references to external objects. Exploiting this vulnerability could allow a remote attacker to perform XXE attacks...

jackson-databind:ObjectReader2Fuzzer: Security exception in com.fasterxml.jackson.databind.deser.std.StdDeserializer._parseBooleanPrimitive

Project: https://github.com/FasterXML/jackson-databind.git Detailed Report: https://oss-fuzz.com/testcase?key=4650513269915648 Project: jackson-databind Fuzzing Engine: libFuzzer Fuzz Target: ObjectReader2Fuzzer Job Type: libfuzzerasanjackson-databind Platform Id: linux Crash Type: Security...

Remote Code Execution

chromium is vulnerable to remote code execution. The vulnerability exists due to the deserialization of untrusted data in FasterXML jackson-databind, allowing a remote attackers to inject and execute malicious code...

Security Bulletin: IBM Integration Bus and IBM App Connect Enterprise are vulnerable to a denial of service due to jackson-databind (CVE-2020-36518)

Summary IBM Integration Bus and IBM App Connect Enterprise are vulnerable to a denial of service due to jackson-databind, caused by a Java StackOverflow exception. The fix includes jackson-databind 2.13.3 Vulnerability Details CVEID:CVE-2020-36518 DESCRIPTION: FasterXML jackson-databind is...

jackson-databind:ObjectReader2Fuzzer: Security exception in com.fasterxml.jackson.databind.deser.BeanDeserializer._deserializeFromArray

Project: https://github.com/FasterXML/jackson-databind.git Detailed Report: https://oss-fuzz.com/testcase?key=4681021680910336 Project: jackson-databind Fuzzing Engine: libFuzzer Fuzz Target: ObjectReader2Fuzzer Job Type: libfuzzerasanjackson-databind Platform Id: linux Crash Type: Security...

jackson-databind:ReadTreeFuzzer: Security exception in com.fasterxml.jackson.core.JsonPointer._parseTail

Project: https://github.com/FasterXML/jackson-databind.git Detailed Report: https://oss-fuzz.com/testcase?key=6669466951352320 Project: jackson-databind Fuzzing Engine: libFuzzer Fuzz Target: ReadTreeFuzzer Job Type: libfuzzerasanjackson-databind Platform Id: linux Crash Type: Security exception...

Security Bulletin: Multiple Vulnerabilities in jackson-databind shipped with IBM Cloud Pak System

Summary Vulnerabilities identified in jackson-databind shipped with IBM Cloud Pak System. IBM Clous Pak System addresssed vulnerabilities. Vulnerability Details CVEID:CVE-2020-10673 DESCRIPTION: FasterXML jackson-databind could allow a remote attacker to execute arbitrary code on the system, caus...

jackson-databind:ReadTreeFuzzer: Uncaught exception in com.fasterxml.jackson.databind.node.ArrayNode.serialize

Project: https://github.com/FasterXML/jackson-databind.git Detailed Report: https://oss-fuzz.com/testcase?key=6442829735395328 Project: jackson-databind Fuzzing Engine: libFuzzer Fuzz Target: ReadTreeFuzzer Job Type: libfuzzerasanjackson-databind Platform Id: linux Crash Type: Uncaught exception...

OESA-2022-1782 jackson-databind security update

The general-purpose data-binding functionality and tree-model for Jackson Data Processor. It builds on core streaming parser/generator package, and uses Jackson Annotations for configuration. Security Fixes: A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through...

Moderate: Red Hat Security Advisory: Red Hat build of Quarkus 2.7.6 release and security update

An update is now available for Red Hat build of Quarkus. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more information...

jackson-databind: denial of service via a large depth of nested objects

A flaw was found in the Jackson Databind package. This cause of the issue is due to a Java StackOverflow exception and a denial of service via a significant depth of nested objects...

Deserialization Of Untrusted Data

Jackson Databind is vulnerable to deserialization of untrusted data. The vulnerability exists in Set function in SubTypeValidator.java when handling interactions related to class ignite-jta which allows an attacker to inject and execute malicious codes...

jackson-databind vulnerable to unsafe deserialization

The com.fasterxml.jackson.core:jackson-databind library before version 2.9.10.4 is vulnerable to an Unsafe Deserialization vulnerability when handling interactions related to the class ignite-jta...

GHSA-RPR3-CW39-3PXH jackson-databind vulnerable to unsafe deserialization

The com.fasterxml.jackson.core:jackson-databind library before version 2.9.10.4 is vulnerable to an Unsafe Deserialization vulnerability when handling interactions related to the class ignite-jta...

Security Bulletin: Vulnerability in the jackson-databind component affects IBM Event Streams

Summary This security vulnerability affects the jackson-databind component that is used by IBM Event Streams. Vulnerability Details IBM X-Force ID: 217968 DESCRIPTION: FasterXML jackson-databind is vulnerable to a denial of service, caused by an error when using JDK serialization to serialize and...

Security Bulletin: IBM MQ Appliance is affected by FasterXML jackson-databind vulnerabilities (CVE-2020-36518)

Summary IBM MQ Appliance has resolved FasterXML jackson-databind vulnerabilities. Vulnerability Details CVEID: CVE-2020-36518 DESCRIPTION: FasterXML jackson-databind is vulnerable to a denial of service, caused by a Java StackOverflow exception. By using a large depth of nested objects, a remote...

Security Bulletin: Denial of Service vulnerability affect IBM Business Automation Workflow and IBM Business Process Manager (BPM) - CVE-2020-35618

Summary IBM Business Process Manager and IBM Business Automation Workflow are vulnerable to a Denial of Service attack. Vulnerability Details CVEID:CVE-2020-36518 DESCRIPTION: FasterXML jackson-databind is vulnerable to a denial of service, caused by a Java StackOverflow exception. By using a lar...